Fix buffer overflows in eve.c (sf.net #3034056)

[monky] / src / mail.c

diff --git a/src/mail.c b/src/mail.c
index bfd80fe..ab2bc47 100644 (file)
--- a/src/mail.c
+++ b/src/mail.c
@@ -61,6 +61,8 @@
 #define POP3_TYPE 1
 #define IMAP_TYPE 2
 
+#define MAXSIZE 1024
+
 struct mail_s {                        // for imap and pop3
        unsigned long unseen;
        unsigned long messages;
@@ -70,11 +72,11 @@ struct mail_s {                     // for imap and pop3
        unsigned int retries;
        float interval;
        double last_update;
-       char host[128];
-       char user[128];
-       char pass[128];
-       char command[1024];
-       char folder[128];
+       char host[MAXSIZE];
+       char user[MAXSIZE];
+       char pass[MAXSIZE];
+       char command[MAXSIZE];
+       char folder[MAXSIZE];
        timed_thread *p_timed_thread;
        char secure;
 };
@@ -413,7 +415,8 @@ struct mail_s *parse_mail_args(char type, const char *arg)
        mail = malloc(sizeof(struct mail_s));
        memset(mail, 0, sizeof(struct mail_s));
 
-       if (sscanf(arg, "%128s %128s %128s", mail->host, mail->user, mail->pass)
+#define lenstr "%1023s"
+       if (sscanf(arg, lenstr " " lenstr " " lenstr, mail->host, mail->user, mail->pass)
                        != 3) {
                if (type == POP3_TYPE) {
                        NORM_ERR("Scanning POP3 args failed");
@@ -431,7 +434,8 @@ struct mail_s *parse_mail_args(char type, const char *arg)
                term.c_lflag &= ~ECHO;
                tcsetattr(fp, TCSANOW, &term);
                printf("Enter mailbox password (%s@%s): ", mail->user, mail->host);
-               scanf("%128s", mail->pass);
+               scanf(lenstr, mail->pass);
+#undef lenstr
                printf("\n");
                term.c_lflag |= ECHO;
                tcsetattr(fp, TCSANOW, &term);
@@ -465,34 +469,36 @@ struct mail_s *parse_mail_args(char type, const char *arg)
        if (type == IMAP_TYPE) {
                tmp = strstr(arg, "-f ");
                if (tmp) {
-                       int len = 1024;
+                       int len = MAXSIZE - 1;
                        tmp += 3;
                        if (tmp[0] == '\'') {
-                               len = strstr(tmp + 1, "'") - tmp - 1;
-                               if (len > 1024) {
-                                       len = 1024;
+                               len = strstr(tmp + 1, "'") - tmp;
+                               if (len > MAXSIZE) {
+                                       len = MAXSIZE;
                                }
                        }
-                       strncpy(mail->folder, tmp + 1, len);
+                       strncpy(mail->folder, tmp + 1, len - 1);
                } else {
-                       strncpy(mail->folder, "INBOX", 128);    // default imap inbox
+                       strncpy(mail->folder, "INBOX", MAXSIZE - 1);    // default imap inbox
                }
        }
        tmp = strstr(arg, "-e ");
        if (tmp) {
-               int len = 1024;
+               int len = MAXSIZE - 1;
                tmp += 3;
 
                if (tmp[0] == '\'') {
-                       len = strstr(tmp + 1, "'") - tmp - 1;
-                       if (len > 1024) {
-                               len = 1024;
+                       len = strstr(tmp + 1, "'") - tmp;
+                       if (len > MAXSIZE) {
+                               len = MAXSIZE;
                        }
                }
-               strncpy(mail->command, tmp + 1, len);
+               strncpy(mail->command, tmp + 1, len - 1);
        } else {
                mail->command[0] = '\0';
        }
+       DBGP("mail args parsed: folder: '%s' command: '%s' user: '%s' host: '%s'\n",
+                       mail->folder, mail->command, mail->user, mail->host);
        mail->p_timed_thread = NULL;
        return mail;
 }
@@ -788,15 +794,17 @@ static void *imap_thread(void *arg)
                                while (1) {
                                        /*
                                         * RFC 2177 says we have to re-idle every 29 minutes.
-                                        * We'll do it every 20 minutes to be safe.
+                                        * We'll do it every 10 minutes to be safe.
                                         */
-                                       fetchtimeout.tv_sec = 1200;
+                                       fetchtimeout.tv_sec = 600;
                                        fetchtimeout.tv_usec = 0;
-                                       DBGP2("idling...");
+                                       DBGP("idling...");
                                        FD_ZERO(&fdset);
                                        FD_SET(sockfd, &fdset);
                                        FD_SET(threadfd, &fdset);
-                                       res = select(MAX(sockfd + 1, threadfd + 1), &fdset, NULL, NULL, &fetchtimeout);
+                                       res = select(MAX(sockfd + 1, threadfd + 1), &fdset, NULL,
+                                                       NULL, &fetchtimeout);
+                                       DBGP("done idling");
                                        if (timed_thread_test(mail->p_timed_thread, 1) || (res == -1 && errno == EINTR) || FD_ISSET(threadfd, &fdset)) {
                                                if ((fstat(sockfd, &stat_buf) == 0) && S_ISSOCK(stat_buf.st_mode)) {
                                                        /* if a valid socket, close it */
@@ -809,14 +817,11 @@ static void *imap_thread(void *arg)
                                                        fail++;
                                                        break;
                                                }
-                                       } else {
-                                               fail++;
-                                               break;
                                        }
                                        recvbuf[numbytes] = '\0';
                                        DBGP2("imap_thread() received: %s", recvbuf);
                                        if (strlen(recvbuf) > 2) {
-                                               unsigned long messages, recent;
+                                               unsigned long messages, recent = 0;
                                                char *buf = recvbuf;
                                                char force_check = 0;
                                                buf = strstr(buf, "EXISTS");
@@ -832,7 +837,6 @@ static void *imap_thread(void *arg)
                                                                timed_thread_lock(mail->p_timed_thread);
                                                                if (mail->messages != messages) {
                                                                        force_check = 1;
-                                                                       mail->messages = messages;
                                                                }
                                                                timed_thread_unlock(mail->p_timed_thread);
                                                        }